Courseiva

AWS Certified Solutions Architect Professional SAP-C02 (SAP-C02) — Questions 1501–1575

1660 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 20

Page 21 of 23

Page 22
1501
MCQmedium

A company's AWS environment includes multiple VPCs across several accounts that are connected via a transit gateway. The network team wants to monitor all network traffic between VPCs for security analysis. Which solution is the most scalable and cost-effective?

A.Use AWS Traffic Mirroring to mirror all traffic to a central inspection appliance.
B.Enable VPC Flow Logs and publish them to a central S3 bucket, then use Amazon Athena to query the logs.
C.Enable VPC Flow Logs for each VPC and stream them to Amazon CloudWatch Logs in each account.
D.Place a network load balancer in each VPC and capture traffic using a packet sniffer.
AnswerB

Scalable and cost-effective.

Why this answer

VPC Flow Logs capture IP traffic metadata (not full packets) and can be centrally published to an S3 bucket across accounts using a central logging account. Querying with Athena is serverless, scales automatically, and incurs cost only for data scanned, making it the most scalable and cost-effective solution for security analysis of inter-VPC traffic.

Exam trap

The trap here is that candidates may over-engineer the solution by choosing Traffic Mirroring or NLB-based packet capture, thinking full packet inspection is needed, when metadata from Flow Logs is sufficient for security analysis and far more cost-effective at scale.

How to eliminate wrong answers

Option A is wrong because Traffic Mirroring copies full packet contents to a central appliance, which incurs high data transfer and processing costs, and requires managing a separate inspection instance that does not scale elastically. Option C is wrong because streaming Flow Logs to CloudWatch Logs in each account creates a decentralized, harder-to-query setup with higher per-log ingestion and storage costs, and lacks a single pane of glass for cross-account analysis. Option D is wrong because placing a Network Load Balancer in each VPC does not inherently capture traffic; packet sniffers require agent installation and cannot capture all traffic without significant performance overhead and architectural complexity.

Full explanation →
1502
MCQeasy

A company is building a serverless application using AWS Lambda. The Lambda function needs to process files uploaded to an S3 bucket. The function should be triggered as soon as a new object is created. How should the architect configure this?

A.Configure S3 to send event notifications to the Lambda function directly
B.Configure S3 to send event notifications to an SNS topic, which triggers the Lambda function
C.Configure S3 to send event notifications to an SQS queue, and have the Lambda function poll the queue
D.Configure S3 to send event notifications to Amazon CloudWatch Events, which triggers the Lambda function
AnswerA

S3 event notifications can directly invoke Lambda functions.

Why this answer

Amazon S3 can directly invoke an AWS Lambda function via event notifications when a new object is created. This is the simplest and most direct integration, requiring no intermediate services. S3 publishes an event to Lambda, which then executes the function synchronously, ensuring near-real-time processing of uploaded files.

Exam trap

The trap here is that candidates may overcomplicate the solution by introducing intermediate services like SNS or SQS, not realizing that S3 can directly invoke Lambda with no additional components, which is the simplest and most cost-effective design.

How to eliminate wrong answers

Option B is wrong because while S3 can send notifications to an SNS topic, and SNS can trigger Lambda, this adds unnecessary complexity and latency; the direct S3-to-Lambda integration is simpler and more efficient for this use case. Option C is wrong because S3 can send notifications to an SQS queue, but Lambda would need to poll the queue, introducing polling overhead and potential delays; the requirement is for immediate triggering, not polling. Option D is wrong because S3 does not natively send event notifications to Amazon CloudWatch Events (now Amazon EventBridge); while EventBridge can receive S3 events via CloudTrail or S3 event notifications, this is an indirect path and not the standard configuration for triggering Lambda directly from S3 object creation.

Full explanation →
1503
Multi-Selecthard

A company is migrating a monolithic application to microservices on Amazon ECS. They want to implement a service mesh for observability and traffic management. Which THREE AWS services should they consider?

Select 3 answers
A.Amazon Route 53
B.AWS X-Ray
C.Amazon CloudWatch
D.AWS App Mesh
E.AWS Step Functions
AnswersB, C, D

X-Ray provides distributed tracing.

Why this answer

Options B, C, and D are correct. AWS App Mesh is a service mesh that provides observability and traffic management. AWS X-Ray provides tracing for microservices.

Amazon CloudWatch provides monitoring and logs. Option A is wrong because Amazon Route 53 is DNS, not a service mesh. Option E is wrong because AWS Step Functions is for orchestrating workflows, not service mesh.

Full explanation →
1504
MCQeasy

A company wants to implement a single sign-on (SSO) solution for its employees to access multiple AWS accounts. The company has an existing identity provider (IdP) that supports SAML 2.0. Which AWS service should be used to integrate with the IdP?

A.AWS Directory Service for Microsoft Active Directory.
B.Amazon Cognito user pools.
C.AWS IAM Identity Center.
D.AWS Identity and Access Management (IAM) with SAML federation.
AnswerC

IAM Identity Center integrates with SAML 2.0 IdPs and provides SSO across multiple AWS accounts.

Why this answer

AWS IAM Identity Center (formerly AWS SSO) is the recommended service for centrally managing SSO access to multiple AWS accounts. It natively integrates with external SAML 2.0 identity providers, allowing you to define permissions sets that govern user access across accounts without creating IAM users. This provides a single place to manage user assignments and enforce least-privilege access across your AWS Organization.

Exam trap

The trap here is that candidates often confuse IAM SAML federation (which works for a single account) with IAM Identity Center (which is the correct multi-account SSO solution), leading them to select Option D because they know SAML 2.0 is supported, but they miss the requirement for multiple AWS accounts.

How to eliminate wrong answers

Option A is wrong because AWS Directory Service for Microsoft Active Directory is a managed AD service that supports SAML federation but is designed for integrating with Microsoft AD workloads, not as a general-purpose SAML IdP broker for multiple AWS accounts; it would require additional configuration with IAM roles and does not natively manage cross-account permissions sets. Option B is wrong because Amazon Cognito user pools are intended for customer-facing identity and access management in applications, not for workforce SSO to AWS accounts; they lack the ability to assign permissions sets across multiple AWS accounts. Option D is wrong because IAM with SAML federation allows you to federate a single IdP into a single AWS account, but it does not provide centralized management across multiple accounts; you would need to manually configure roles and trust policies in each account, which is not scalable for multi-account SSO.

Full explanation →
1505
MCQeasy

A company uses AWS CodePipeline for CI/CD. The deployment stage uses AWS CodeDeploy to deploy to EC2 instances. The team wants to automatically test the application after deployment and roll back if tests fail. Which approach should the team use?

A.Create a separate CodePipeline for testing and use a cross-pipeline trigger to initiate rollback.
B.Add a manual approval step after deployment to run tests manually.
C.Use a CloudWatch alarm to monitor test results and trigger a rollback.
D.Add a test stage in CodePipeline after the deployment stage and configure CodeDeploy to automatically roll back on pipeline failure.
AnswerC

This is correct. Using a CloudWatch alarm to monitor test results allows automatic rollback when tests fail. The test stage can publish metrics to CloudWatch, and if the alarm triggers (e.g., test failure), it can invoke a Lambda function to roll back the deployment via CodeDeploy API.

Why this answer

It allows automatic testing and rollback by integrating CloudWatch alarms. After deployment, a test stage can run tests and publish a custom metric to CloudWatch. If the metric breaches a threshold (indicating test failure), a CloudWatch alarm triggers a rollback action, such as an AWS Lambda function that calls the CodeDeploy API to roll back the deployment.

This approach automates the entire process without manual intervention. Option A is incorrect because creating a separate pipeline introduces unnecessary complexity and cross-pipeline triggers are not straightforward for rollback. Option B is incorrect because manual approval steps require human interaction, which is not automatic.

Option D is incorrect because CodeDeploy cannot automatically roll back based on a pipeline failure; CodeDeploy only rolls back on its own deployment failures, not failures in subsequent pipeline stages. The test stage is part of the pipeline, and if it fails, the pipeline fails, but CodeDeploy's rollback is not triggered by pipeline stage failures.

Full explanation →
1506
Multi-Selecthard

A company is designing a microservices architecture on Amazon ECS with Fargate. The services need to communicate securely and efficiently. The company wants to implement service-to-service authentication and authorization. Which THREE steps should the company take? (Choose THREE.)

Select 3 answers
A.Use AWS Secrets Manager to store and rotate service credentials.
B.Configure mutual TLS (mTLS) between services using certificates from ACM.
C.Enable ECS Service Connect between services for automatic DNS and TLS encryption.
D.Deploy an API Gateway in front of each microservice.
E.Use IAM roles for tasks and attach policies that allow access to other services.
AnswersA, C, E

Secrets Manager securely stores credentials for database or API keys.

Why this answer

AWS Secrets Manager provides a secure way to store and automatically rotate service credentials (such as database passwords or API keys) used by microservices running on ECS Fargate. This eliminates hard-coded secrets and reduces the risk of credential exposure, aligning with security best practices for service-to-service authentication.

Exam trap

The trap here is that candidates may confuse mTLS with standard TLS or assume ACM can be used for internal mTLS, but ACM does not support issuing client certificates for service-to-service mutual authentication in ECS Fargate.

Full explanation →
1507
MCQeasy

A company is building a new application that will run on AWS Lambda. The application needs to store and retrieve user preferences in a key-value format. The data is accessed frequently and must be highly available. The company expects low latency for reads and writes. Which AWS service should be used as the data store?

A.Amazon S3
B.Amazon ElastiCache for Memcached
C.Amazon RDS for PostgreSQL
D.Amazon DynamoDB
AnswerD

Amazon DynamoDB is a fully managed NoSQL key-value and document database that provides single-digit millisecond latency at any scale, with built-in high availability and durability, making it the best choice for this use case.

Why this answer

Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers single-digit millisecond performance at any scale. It is designed for low-latency, high-availability access, making it ideal for storing and retrieving user preferences in a key-value format. Option A: Amazon S3 is object storage, not a key-value store, and is not optimized for low-latency reads and writes for small objects.

Option B: Amazon ElastiCache for Memcached is an in-memory key-value store, but it is not persistent and typically used for caching, not as a primary data store for persistent user preferences. Option C: Amazon RDS for PostgreSQL is a relational database, which requires schema definition and is not optimized for simple key-value access patterns.

Full explanation →
1508
Drag & Dropmedium

Drag and drop the steps to configure an S3 bucket as a static website hosting in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

The correct sequence ensures that the S3 bucket is properly configured for static website hosting. Start by creating the bucket, then enable static hosting, upload your files, apply a bucket policy for public read access, and finally test the website URL.

Full explanation →
1509
MCQmedium

A company is designing a new serverless application using AWS Lambda. The function must process a file uploaded to S3 and then send a notification to an external API. The external API has a rate limit of 10 requests per second. Which approach should they use to handle throttling?

A.Use Amazon SQS to buffer the requests and set a Lambda reserved concurrency to limit the processing rate
B.Increase the Lambda function timeout and retry on failure
C.Configure a Lambda function destination on failure to reprocess
D.Use Amazon SNS to fan out the notification to multiple Lambda functions
AnswerA

SQS can buffer requests and Lambda reserved concurrency can limit concurrency, effectively throttling the rate.

Why this answer

Amazon SQS acts as a durable buffer that decouples the S3 event from the Lambda invocation, allowing the function to poll messages at a controlled rate. By setting a Lambda reserved concurrency, you limit the number of concurrent executions, which directly caps the processing rate to stay within the external API's 10 requests per second limit. This combination ensures that the Lambda function does not exceed the API's throttling threshold while still processing all events reliably.

Exam trap

The trap here is that candidates often choose SNS fan-out (Option D) thinking it improves throughput, but they fail to recognize that it amplifies concurrency and worsens throttling, whereas SQS with reserved concurrency provides controlled, decoupled processing.

How to eliminate wrong answers

Option B is wrong because increasing the Lambda function timeout does not control the invocation rate; it only extends the maximum execution duration, which does not prevent bursts of concurrent invocations from exceeding the API rate limit. Option C is wrong because configuring a Lambda function destination on failure to reprocess only handles individual invocation errors (e.g., code exceptions) but does not address rate-based throttling from the external API; it would still allow excessive concurrent requests. Option D is wrong because using Amazon SNS to fan out notifications to multiple Lambda functions would increase the number of concurrent invocations, making the throttling problem worse instead of solving it.

Full explanation →
1510
MCQeasy

A company uses Amazon RDS for PostgreSQL and needs to apply a minor version upgrade. They want to minimize downtime. Which approach should they use?

A.Apply the upgrade during the maintenance window
B.Create a read replica, upgrade it, and promote it
C.Use a Multi-AZ deployment and apply the upgrade
D.Modify the DB parameter group to set the version
AnswerC

Using a Multi-AZ deployment and applying the upgrade takes advantage of the built-in failover mechanism: the standby is upgraded first, then a failover occurs, minimizing downtime to just the time needed for the failover (typically less than a minute).

Why this answer

To minimize downtime for a PostgreSQL minor version upgrade on Amazon RDS, the best approach is to use a Multi-AZ deployment and then apply the upgrade. With Multi-AZ, RDS upgrades the standby instance first, then performs a failover, resulting in very minimal downtime (typically under a minute). Option A (maintenance window) can cause longer downtime depending on the window.

Option B (read replica) is more complex and can have a longer cutover time, and is not the most efficient for minor upgrades. Option D (modify parameter group) does not upgrade the engine version.

Full explanation →
1511
Multi-Selecthard

A company has a multi-account AWS environment with a centralized logging account. The security team needs to analyze VPC Flow Logs from all accounts using Amazon Athena. Which THREE steps are required to enable this analysis? (Choose THREE.)

Select 3 answers
A.Create an AWS Glue table or use Athena's CREATE TABLE statement to define the schema of the Flow Logs.
B.Ensure the Flow Logs are delivered in GZIP format (default) or uncompressed.
C.Deliver VPC Flow Logs from each account to a centralized S3 bucket in the logging account.
D.Replicate the S3 bucket to a single AWS Region for consistency.
E.Configure a Kinesis Data Firehose delivery stream to convert Flow Logs to Parquet format.
AnswersA, B, C

Athena needs a table definition to query the data.

Why this answer

Athena requires a schema definition to query data in S3. You can either create an AWS Glue table (which is a managed schema catalog) or use Athena's CREATE TABLE statement to define the schema for VPC Flow Logs, including fields like version, account-id, interface-id, srcaddr, dstaddr, etc. Without this schema, Athena cannot parse the raw flow log data.

Exam trap

The trap here is that candidates may think converting to Parquet or replicating across regions is mandatory, but AWS allows direct querying of GZIP text files in a single centralized S3 bucket without additional transformation or replication.

Full explanation →
1512
MCQeasy

A company has a centralized logging solution using Amazon OpenSearch Service (Elasticsearch) and wants to ensure logs from all AWS accounts are shipped to a central account. Which AWS service can be used to collect and forward logs from multiple accounts to a single destination?

A.Amazon S3 bucket with cross-account bucket policy
B.Amazon Kinesis Data Firehose delivery stream with cross-account access
C.Amazon CloudWatch Logs subscription filter
D.AWS Lambda function in each account that sends logs to a central API
AnswerB

Firehose can accept data from multiple accounts via IAM roles and deliver to a central OpenSearch domain.

Why this answer

Amazon Kinesis Data Firehose can be configured with cross-account access by using a resource-based policy on the delivery stream that grants permissions to other AWS accounts to write log data directly. This allows logs from multiple accounts to be sent to a single Firehose delivery stream in the central account, which then delivers the logs to the OpenSearch Service domain. The cross-account capability is essential for aggregating logs without requiring intermediate storage or complex custom solutions.

Exam trap

The trap here is that candidates often assume CloudWatch Logs subscription filters (Option C) can natively forward logs across accounts, but they cannot; they require additional cross-account mechanisms like a Lambda function or Firehose with proper permissions, making Firehose the correct managed service for this centralized logging scenario.

How to eliminate wrong answers

Option A is wrong because an Amazon S3 bucket with a cross-account bucket policy can store logs from multiple accounts, but it does not actively collect and forward logs to OpenSearch Service; it is a passive storage destination and would require additional services (e.g., Lambda or Firehose) to ingest into OpenSearch. Option C is wrong because a CloudWatch Logs subscription filter can forward logs to a single destination like Firehose or Lambda, but it operates within the same account only; cross-account subscription filters are not supported natively without additional infrastructure (e.g., cross-account Lambda). Option D is wrong because using a Lambda function in each account to send logs to a central API introduces unnecessary complexity, potential latency, and single points of failure, and is not a managed, scalable service designed for this purpose; it also requires custom code and error handling.

Full explanation →
1513
Multi-Selecthard

Which THREE design patterns can help a microservices application achieve loose coupling and independent deployability? (Choose three.)

Select 3 answers
A.Shared database schema across services
B.Circuit breaker pattern to handle service failures
C.Synchronous RESTful HTTP calls between services
D.Event-driven communication using Amazon SNS and SQS
E.API Gateway as a facade for service endpoints
AnswersB, D, E

Circuit breakers isolate failures, allowing services to degrade gracefully without impacting others.

Why this answer

The circuit breaker pattern (B) prevents cascading failures by monitoring for failures and opening the circuit to stop calls to an unhealthy service, allowing it time to recover. This supports loose coupling because the caller does not need to know the internal state of the downstream service, and it enables independent deployability by isolating failures during deployment or scaling events.

Exam trap

The trap here is that candidates often confuse synchronous RESTful calls (C) as a valid pattern for loose coupling, but in reality, synchronous calls create tight temporal coupling and reduce independent deployability, whereas event-driven and facade patterns (D and E) are the correct approaches.

Full explanation →
1514
Multi-Selectmedium

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all accounts use AWS CloudTrail with logs delivered to a central S3 bucket. Which TWO actions should be taken to enforce this?

Select 2 answers
A.Create an IAM role in each account that requires CloudTrail to be enabled
B.Use CloudFormation StackSets to deploy a CloudTrail trail in each account
C.Use AWS Config rules to detect when CloudTrail is not configured correctly and trigger remediation
D.Use AWS Lambda to automatically re-enable CloudTrail if it is disabled
E.Use a service control policy (SCP) to deny actions that disable CloudTrail or modify the trail configuration
AnswersC, E

Config rules can monitor and auto-remediate to ensure compliance.

Why this answer

AWS Config rules can be used to continuously monitor CloudTrail configuration across accounts and automatically trigger remediation actions (e.g., via AWS Systems Manager Automation or Lambda) when non-compliance is detected. This ensures that any drift from the required CloudTrail setup is corrected without manual intervention, providing a detective and corrective control. Option E is correct because a service control policy (SCP) can deny the cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail actions at the organizational level, preventing any account from disabling or modifying the central CloudTrail trail, thus enforcing the required configuration proactively.

Exam trap

The trap here is that candidates often confuse initial deployment (CloudFormation StackSets) with ongoing enforcement, or they mistakenly believe that a reactive Lambda function is sufficient for compliance, failing to recognize that SCPs and Config rules provide the necessary preventive and detective controls required by the security team's goal of ensuring all accounts use CloudTrail with logs delivered to a central S3 bucket.

Full explanation →
1515
MCQmedium

A company uses AWS Organizations with multiple accounts. The security team requires that all S3 buckets across the organization have server-side encryption enabled. Which is the MOST efficient way to enforce this policy?

A.Use AWS CloudTrail to monitor and alert on unencrypted buckets
B.Enable S3 default encryption in each account
C.Apply a service control policy (SCP) that denies creation of S3 buckets without encryption
D.Use S3 bucket policies to require encryption
AnswerC

SCP can be applied to the entire organization or OU to enforce encryption at account creation.

Why this answer

A service control policy (SCP) can centrally deny the creation of S3 buckets that do not have server-side encryption enabled across all accounts in an AWS Organization. This approach enforces the security team's requirement at the organizational level, preventing non-compliant buckets from being created regardless of individual account configurations, which is the most efficient and scalable method.

Exam trap

The trap here is that candidates often confuse S3 bucket policies (which control access to objects) with SCPs (which control API actions at the account level), leading them to choose option D, which cannot enforce encryption on the bucket itself.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail only provides logging and monitoring capabilities; it cannot proactively enforce or prevent the creation of unencrypted buckets, only alert after the fact. Option B is wrong because enabling S3 default encryption in each account relies on individual account administrators to configure it correctly, and it does not prevent users from explicitly overriding the default during bucket creation. Option D is wrong because S3 bucket policies can require encryption for objects uploaded to a bucket, but they do not enforce encryption on the bucket itself (i.e., the bucket's default encryption setting) and cannot prevent the creation of a bucket without encryption enabled.

Full explanation →
1516
MCQhard

Refer to the exhibit. A company is using AWS CloudFormation to migrate a serverless application. The stack creation failed. Based on the stack events, what is the root cause of the failure?

A.The CloudFormation template has a syntax error.
B.The AWS Lambda runtime specified in the template is not supported in the us-east-1 region.
C.The IAM role for the Lambda function does not have sufficient permissions.
D.The Lambda function code exceeds the maximum size limit.
AnswerB

The runtime is not supported.

Why this answer

The stack event error message indicates that the Lambda runtime 'nodejs18.x' is not supported in the us-east-1 region. This is a specific runtime issue, not a syntax error (A), permission issue (C), or code size limit (D).

Full explanation →
1517
MCQeasy

A company wants to deploy a new web application on AWS that uses a microservices architecture. The company expects rapid growth and wants to decouple services to allow independent scaling and development. The team wants to use Docker containers for consistency across environments. Which solution should a Solutions Architect recommend?

A.Use Amazon Lightsail containers to deploy each microservice as a container service.
B.Deploy each microservice on separate EC2 instances behind an Application Load Balancer.
C.Use Amazon ECS with Fargate to run each microservice as a separate task definition, with service auto scaling.
D.Use AWS Elastic Beanstalk with Docker platform to deploy each microservice as a separate environment.
AnswerC

ECS with Fargate is a fully managed container service that decouples services and scales independently.

Why this answer

Amazon ECS with Fargate is a fully managed container orchestration service that allows each microservice to run as a separate task definition, enabling independent scaling and decoupling. Fargate eliminates the need to manage underlying EC2 instances, aligning with the requirement for Docker containers and microservices architecture.

Option A is incorrect because Amazon Lightsail containers are designed for simpler workloads and lack the advanced orchestration, scaling, and networking features required for a microservices architecture at scale.

Option B is incorrect because deploying each microservice on separate EC2 instances does not leverage containerization, leading to resource inefficiency and management overhead. An Application Load Balancer can distribute traffic but does not provide the independent scaling and isolation that containers offer.

Option D is incorrect because AWS Elastic Beanstalk with Docker platform abstracts container management but imposes a PaaS model that may limit granular control over individual microservices. It is less suitable for decoupled microservices that require independent deployment and scaling compared to ECS with Fargate.

Full explanation →
1518
Multi-Selecteasy

A company is designing a new application that will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The application must be highly available and fault-tolerant across multiple Availability Zones. Which TWO actions should be taken to achieve this? (Choose two.)

Select 2 answers
A.Use an Auto Scaling group to launch instances only in one Availability Zone.
B.Use a Network Load Balancer instead of ALB for better performance.
C.Launch EC2 instances in at least two Availability Zones.
D.Configure the ALB to be internet-facing and register instances from multiple AZs.
E.Launch all EC2 instances in a single Availability Zone for low latency.
AnswersC, D

Multiple AZs provide fault tolerance if one AZ fails.

Why this answer

Launching EC2 instances in at least two Availability Zones (AZs) ensures that if one AZ fails, the application continues to run from the other AZ, providing fault tolerance and high availability. Option D is correct because configuring the ALB to be internet-facing and registering instances from multiple AZs allows the ALB to distribute incoming traffic across healthy instances in different AZs, automatically rerouting traffic if an AZ becomes impaired.

Exam trap

The trap here is that candidates often think a single AZ with Auto Scaling is sufficient for high availability, but true fault tolerance requires distributing resources across multiple AZs to survive an AZ-level failure.

Full explanation →
1519
MCQhard

A company is migrating a legacy CRM application to AWS. The application uses a proprietary database that is not supported by Amazon RDS. The company wants to minimize licensing costs. The current on-premises deployment uses a single server. Which migration strategy should the company use?

A.Rehost the application on Amazon EC2 and install the same proprietary database on an EC2 instance.
B.Rehost the application, but replace the database with a SaaS alternative.
C.Refactor the application to use a different database engine that is supported by Amazon RDS.
D.Use AWS Database Migration Service (DMS) to migrate the database to Amazon RDS.
AnswerA

Rehosting with the same database minimizes licensing costs.

Why this answer

Rehosting (lift-and-shift) the application on EC2 with the same proprietary database minimizes licensing costs by using existing licenses, and avoids the need to refactor or replace the database. Option B is wrong because replacing the database with a SaaS alternative may increase costs and complexity. Option C is wrong because refactoring to use a different database engine would require significant application changes and may incur new licensing costs.

Option D is wrong because DMS cannot migrate to a proprietary database unsupported by RDS, and RDS does not support the proprietary database.

Full explanation →
1520
MCQhard

A company uses AWS Organizations with 500 accounts. They want to enforce that all accounts use a specific set of allowed AMIs for EC2. What is the MOST scalable solution?

A.Apply an SCP that denies ec2:RunInstances with a condition on ec2:ImageId.
B.Use AWS Config to detect non-compliant AMIs and stop the instances.
C.Create a service catalog product for EC2 with allowed AMIs.
D.Use AWS Systems Manager to enforce AMI compliance.
AnswerA

SCP applies to all accounts in the organization.

Why this answer

An SCP applied at the root or OU level can deny ec2:RunInstances unless the ec2:ImageId matches a specific set of allowed AMIs. This scales to 500 accounts without per-account configuration, as SCPs are inherited by all accounts in the organization. The condition key ec2:ImageId supports wildcard patterns or a list of AMI IDs, making it a centralized, preventive control.

Exam trap

The trap here is that candidates confuse detective controls (AWS Config) with preventive controls (SCPs), assuming detection and remediation are as scalable as prevention, but SCPs block the action before it happens, which is the most scalable and least disruptive approach for 500 accounts.

How to eliminate wrong answers

Option B is wrong because AWS Config is detective, not preventive; it can detect non-compliant AMIs after launch and trigger a remediation (e.g., stop instances), but it does not prevent the initial launch, and stopping instances is disruptive and less scalable. Option C is wrong because Service Catalog provides a curated product list but does not enforce that users must use it; users can still launch EC2 instances outside Service Catalog via the console or API, so it is not a scalable enforcement mechanism. Option D is wrong because AWS Systems Manager is an operations management service that can patch or remediate instances after launch, but it cannot prevent the initial launch of a non-compliant AMI; it is reactive, not preventive.

Full explanation →
1521
MCQeasy

A company wants to decouple a web application frontend from a backend processing service. The frontend sends jobs that are processed asynchronously. Which AWS service is best suited for this decoupling?

A.Amazon SQS
B.Amazon SNS
C.Amazon Kinesis
D.AWS Step Functions
AnswerA

SQS provides a reliable message queue.

Why this answer

Amazon SQS is the best choice for decoupling a web application frontend from a backend processing service because it provides a fully managed message queue that allows the frontend to send jobs (messages) asynchronously without waiting for the backend to process them. The backend can poll the queue at its own pace, ensuring reliable, scalable, and fault-tolerant communication between the two components. SQS supports standard queues for high throughput and FIFO queues for exactly-once processing, making it ideal for decoupling asynchronous workloads.

Exam trap

The trap here is that candidates often confuse SNS (push-based pub/sub) with SQS (pull-based queue) for decoupling, failing to recognize that asynchronous job processing requires the backend to pull messages, not receive pushes, and that SNS alone does not provide a buffer for unprocessed jobs.

How to eliminate wrong answers

Option B (Amazon SNS) is wrong because SNS is a pub/sub messaging service that pushes messages to multiple subscribers, not a queue; it does not provide the decoupling needed for asynchronous job processing where the backend pulls messages at its own pace. Option C (Amazon Kinesis) is wrong because Kinesis is designed for real-time streaming data ingestion and processing (e.g., logs, metrics), not for decoupling discrete job requests between a frontend and backend; it introduces complexity and cost overhead for simple job queues. Option D (AWS Step Functions) is wrong because Step Functions is a serverless orchestration service for coordinating multiple AWS services into workflows, not a message queue; it is used for stateful workflows, not for decoupling frontend and backend via asynchronous message passing.

Full explanation →
1522
Multi-Selectmedium

A company is migrating a multi-tier web application to AWS and wants to use Infrastructure as Code (IaC) to automate provisioning. Which AWS services can the company use to define and manage infrastructure declaratively? (Choose TWO.)

Select 2 answers
A.AWS Elastic Beanstalk
B.AWS CloudFormation
C.AWS OpsWorks
D.AWS Cloud Development Kit (CDK)
E.AWS CodeDeploy
AnswersB, D

CloudFormation allows declarative infrastructure as code.

Why this answer

AWS CloudFormation and AWS CDK are correct because both allow declarative infrastructure definition. AWS Elastic Beanstalk is a PaaS service, not dedicated Infrastructure as Code. AWS OpsWorks is configuration management.

AWS CodeDeploy is for deployment automation.

Full explanation →
1523
MCQhard

A company is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. The company wants to minimize operational overhead and ensure that service discovery is automatically updated when services scale. Which service discovery option should be used?

A.AWS Cloud Map
B.Amazon ECS service connect
C.Elastic Load Balancing with internal NLB
D.Amazon Route 53 private hosted zones with health checks
AnswerA

Cloud Map automatically manages service discovery.

Why this answer

AWS Cloud Map provides service discovery that automatically updates with service scaling.

Full explanation →
1524
Multi-Selecthard

A company wants to implement a data lake strategy using Amazon S3 across multiple AWS accounts. They need to ensure that data is encrypted at rest using a centralized AWS KMS key from a security account. Which THREE steps should they take?

Select 3 answers
A.Configure S3 bucket policies in each account to enforce encryption using the KMS key.
B.Configure S3 buckets in each account to use the shared KMS key for server-side encryption.
C.Create a customer managed KMS key in the security account and share it with the other accounts using AWS Resource Access Manager (RAM).
D.Create IAM users in the security account and grant them access to the KMS key.
E.Apply a service control policy (SCP) that denies s3:PutObject unless the request uses the required KMS key.
AnswersB, C, E

Buckets must be configured to use the shared key for encryption.

Why this answer

Configuring S3 buckets to use the shared KMS key for server-side encryption (SSE-KMS) ensures that all objects written to the bucket are encrypted at rest with the centralized key. Option C is correct because the KMS key must be created in the security account and shared via AWS RAM to allow other accounts to use it for encryption. Option E is correct because a service control policy (SCP) can be applied to deny s3:PutObject unless the request includes the required KMS key, providing an additional enforcement layer.

Together, these steps enforce centralized encryption across accounts.

Exam trap

The trap here is that candidates often confuse S3 bucket policies with default encryption settings, thinking a bucket policy can enforce a specific KMS key ARN, when in reality bucket policies can only check for the presence of encryption headers or a key ID via condition keys, not enforce the exact key used for encryption.

Full explanation →
1525
Multi-Selecteasy

A company wants to store configuration data for multiple applications securely. Each application runs on Amazon EC2 instances in an Auto Scaling group. The configuration includes database credentials and API keys. Which TWO services should be used together to achieve this?

Select 2 answers
A.AWS Secrets Manager.
B.Amazon S3 with bucket policies.
C.IAM roles for EC2 instances.
D.EC2 user data scripts.
E.AWS Systems Manager Parameter Store.
AnswersC, E

IAM roles allow instances to access Parameter Store without credentials.

Why this answer

And E. IAM roles for EC2 instances (C) allow EC2 to securely access other AWS services without hardcoding credentials. AWS Systems Manager Parameter Store (E) provides secure, hierarchical storage for configuration data and secrets.

Together, they enable EC2 to retrieve configuration data like database credentials and API keys at runtime without embedding secrets in code or user data. Option A (Secrets Manager) is also valid for secrets, but the question asks for two services, and the marked correct pair is C and E. Option B (S3 with bucket policies) is insecure for secrets, and option D (EC2 user data) is not secure for credentials.

Full explanation →
1526
MCQhard

A company is planning to migrate a large-scale e-commerce platform from on-premises to AWS. The platform includes a web tier, application tier, and a MySQL database. The company needs to ensure high availability and scalability. Which combination of AWS services should the company use to modernize the application architecture while minimizing operational overhead?

A.Use Elastic Load Balancer, Amazon EC2 instances for the web tier, and Amazon ECS with Fargate for the application tier, and Amazon RDS for MySQL.
B.Use Application Load Balancer, Amazon ECS with Fargate for both web and application tiers, and Amazon Aurora MySQL.
C.Use Amazon CloudFront, Amazon EC2 instances for the application tier, and Amazon DynamoDB.
D.Use Amazon EC2 Auto Scaling groups for both web and application tiers, and Amazon RDS for MySQL with Multi-AZ.
AnswerB

Fargate eliminates server management, and Aurora provides managed MySQL with high availability.

Why this answer

It uses a managed container service (ECS with Fargate) for both web and application tiers, eliminating server management overhead, and Amazon Aurora MySQL provides a MySQL-compatible, highly available, and scalable managed database. Option A is incorrect because although it includes a load balancer and ECS with Fargate for the application tier, it uses unmanaged EC2 instances for the web tier, increasing operational overhead. Option C is incorrect because it proposes DynamoDB, which is NoSQL and not suitable for a MySQL-based e-commerce platform.

Option D is incorrect because it uses EC2 instances for both tiers, requiring more manual management compared to a containerized solution.

Full explanation →
1527
MCQmedium

A company is designing a new solution that uses Amazon S3 to store large amounts of archival data. The data must be retained for 7 years and then automatically deleted. Which S3 feature should they use?

A.S3 Replication
B.S3 Versioning
C.S3 Object Lock
D.S3 Lifecycle policies
AnswerD

Lifecycle policies can automatically delete objects after a set period.

Why this answer

S3 Lifecycle policies allow you to define rules that automatically expire objects after a specified period, such as 7 years. This directly meets the requirement to retain archival data for a fixed duration and then delete it without manual intervention.

Exam trap

The trap here is that candidates often confuse S3 Object Lock's retention period with automatic deletion, not realizing that Object Lock only prevents deletion during the retention window and requires a separate lifecycle rule to actually remove the objects afterward.

How to eliminate wrong answers

Option A is wrong because S3 Replication is used to copy objects across buckets for redundancy or compliance, not to manage retention or deletion based on time. Option B is wrong because S3 Versioning preserves multiple versions of an object and does not provide automatic deletion after a set period; it can actually increase storage costs if not combined with lifecycle rules. Option C is wrong because S3 Object Lock is designed to prevent object deletion or overwrites for a fixed retention period (compliance or governance mode), but it does not automatically delete objects after that period ends—it only prevents premature deletion, and objects remain until manually removed or a lifecycle rule is applied.

Full explanation →
1528
Multi-Selectmedium

A company is running a critical application on Amazon EC2 instances in an Auto Scaling group. The application stores data on an Amazon EBS volume. To improve recovery time in the event of an AZ failure, which TWO actions should the company take? (Choose two.)

Select 2 answers
A.Create an Amazon Machine Image (AMI) from the instance.
B.Use EBS multi-attach to attach the volume to instances in another AZ.
C.Copy the EBS volume to another AZ using the AWS Management Console.
D.Take regular EBS snapshots and copy them to another region.
E.Configure the Auto Scaling group to launch instances in multiple AZs.
AnswersA, E

Creating an AMI provides a pre-configured instance template that can be launched in another AZ quickly, reducing recovery time.

Why this answer

Options A and E are correct. Creating an AMI from the instance (A) allows you to quickly launch a new instance in another AZ with the same configuration, improving recovery time. Configuring the Auto Scaling group to launch instances in multiple AZs (E) ensures that the application is already running in another AZ, minimizing downtime during an AZ failure.

Option B is incorrect because EBS multi-attach is for attaching a volume to multiple instances in the same AZ, not for cross-AZ recovery. Option C is incorrect because you cannot directly copy an EBS volume to another AZ; you must create a snapshot and then create a volume in the target AZ within the same region. Option D is incorrect because copying snapshots to another region is designed for regional disasters, not for within-region AZ failures; for AZ failure, you would restore snapshots within the same region.

Full explanation →
1529
Multi-Selectmedium

A company is designing a new solution to host a static website with global low latency. The website content is stored in an S3 bucket. The company wants to use a custom domain name and SSL/TLS termination. Which THREE services should the company use together to meet these requirements? (Choose THREE.)

Select 3 answers
A.Amazon CloudFront with an S3 origin.
B.AWS WAF to protect the website.
C.Amazon S3 to store the website content.
D.Application Load Balancer to distribute traffic across multiple S3 buckets.
E.Amazon Route 53 to point the custom domain to CloudFront.
AnswersA, C, E

CloudFront provides global content delivery and SSL termination.

Why this answer

Amazon CloudFront with an S3 origin is correct because CloudFront is a global content delivery network (CDN) that caches static content at edge locations, providing low-latency access worldwide. It also supports custom domain names via alternate domain names (CNAMEs) and integrates with AWS Certificate Manager (ACM) for SSL/TLS termination, meeting all requirements for hosting a static website with global performance and security.

Exam trap

The trap here is that candidates often confuse AWS WAF as a mandatory component for security compliance, but the question only asks for services to meet the specific requirements of hosting a static website with global low latency, custom domain, and SSL/TLS termination—WAF is not required for these core functions.

Full explanation →
1530
Multi-Selectmedium

A company is migrating a large number of files from on-premises to Amazon S3. The files are accessed frequently and require low latency. Which TWO AWS services can help accelerate the migration? (Choose TWO.)

Select 2 answers
A.AWS Storage Gateway
B.AWS CloudFormation
C.AWS DataSync
D.Amazon S3 Transfer Acceleration
E.AWS Snowball Edge
AnswersC, E

DataSync automates and accelerates data transfer.

Why this answer

Correct answers: C (AWS DataSync) and E (AWS Snowball Edge). AWS DataSync automates and accelerates transferring large amounts of data over the network, making it ideal for frequent, low-latency access. AWS Snowball Edge is a petabyte-scale data transport solution that uses secure physical devices to transfer large datasets offline, bypassing network constraints.

Option A (AWS Storage Gateway) is a hybrid storage service, not a migration accelerator. Option B (AWS CloudFormation) is for infrastructure as code, not data transfer. Option D (Amazon S3 Transfer Acceleration) speeds up uploads but is a feature of S3, not a standalone migration service.

Full explanation →
1531
MCQeasy

A company needs to share a VPC subnet with multiple accounts in the same AWS Organization. What is the MOST secure way to achieve this?

A.Create a Transit Gateway and attach all accounts.
B.Set up a VPN connection between accounts.
C.Use AWS RAM to share the subnet with the organization.
D.Create a VPC peering connection between each account and the VPC owner.
AnswerC

RAM allows sharing subnets with accounts in the organization.

Why this answer

AWS Resource Access Manager (RAM) allows you to share a subnet with other accounts within the same AWS Organization without requiring any intermediate networking appliances or complex routing. This is the most secure approach because the shared subnet remains under the VPC owner's administrative control, and participating accounts can launch resources directly into the subnet while inheriting the VPC's security policies. No traffic traverses external connections or third-party devices, reducing the attack surface.

Exam trap

The trap here is that candidates often confuse network connectivity solutions (Transit Gateway, VPC peering, VPN) with resource sharing, assuming that to 'share' a subnet you must connect the VPCs, when in fact AWS RAM provides a direct, secure, and managed way to share subnets without any network-level interconnection.

How to eliminate wrong answers

Option A is wrong because a Transit Gateway is a network transit hub used to interconnect VPCs and on-premises networks, not a mechanism to share a subnet; attaching accounts via Transit Gateway would require separate VPCs and routing, not direct subnet sharing. Option B is wrong because a VPN connection between accounts would create an encrypted tunnel over the internet, which is unnecessary overhead and introduces latency and complexity for sharing a subnet that should be accessed natively within the same AWS backbone. Option D is wrong because VPC peering connects entire VPCs, not individual subnets, and requires managing multiple peering connections and route tables; it also does not allow the peered accounts to launch resources directly into the owner's subnet.

Full explanation →
1532
MCQhard

A company is migrating a 10 TB Oracle database to Amazon Aurora PostgreSQL. The migration must have minimal downtime and support ongoing replication. The application uses stored procedures and advanced Oracle features. The company has already set up an AWS DMS replication instance and validated connectivity. However, during the full load, DMS reports errors for certain tables containing LOBs. What is the most likely cause and solution?

A.The DMS replication instance does not have enough memory. Increase the instance size.
B.The target Aurora PostgreSQL cluster does not have enough storage. Increase the allocated storage.
C.The LOB mode is set to 'Limited LOB mode' and some LOBs exceed the maximum allowed size. Set LOB mode to 'Full LOB mode'.
D.The source database is not configured for change data capture (CDC). Enable supplemental logging.
AnswerC

Limited LOB mode has a size limit; Full LOB mode handles large LOBs but may impact performance.

Why this answer

AWS DMS uses 'Limited LOB mode' by default for Oracle to Aurora PostgreSQL migrations, which truncates LOBs larger than the allowed size (default 32 KB). When LOBs exceed this limit during full load, DMS reports errors. Setting LOB mode to 'Full LOB mode' bypasses this size restriction, allowing DMS to migrate LOBs of any size.

Option A is incorrect because memory issues typically cause performance degradation, not specific LOB errors. Option B is incorrect because storage capacity on the target does not affect LOB loading; Aurora PostgreSQL scales automatically. Option D is incorrect because CDC (Change Data Capture) configuration is for ongoing replication, not for full load of LOBs.

Full explanation →
1533
MCQhard

A company is migrating a legacy application to AWS. The application requires a fixed IP address for whitelisting by a third-party service. The application will run on EC2 instances behind an Application Load Balancer. The company needs a solution that provides a static IP address for outbound traffic. What should a solutions architect do?

A.Replace the ALB with a Network Load Balancer and assign Elastic IPs.
B.Assign an Elastic IP address to the Application Load Balancer.
C.Place the EC2 instances in a private subnet and route outbound traffic through a NAT Gateway with an Elastic IP.
D.Attach an Internet Gateway to the VPC and assign an Elastic IP to it.
AnswerC

NAT Gateway with Elastic IP provides a static source IP for outbound traffic.

Why this answer

A NAT Gateway in a public subnet with an Elastic IP provides a static IP for outbound traffic from instances in private subnets. This allows the third-party service to whitelist that IP address. Option A is incorrect because replacing the ALB with an NLB would affect inbound traffic handling and does not solve outbound static IP requirements.

Option B is incorrect because an Application Load Balancer cannot be assigned an Elastic IP; it uses dynamic IP addresses. Option D is incorrect because an Internet Gateway does not provide a static IP; it allows communication between VPC and internet but does not source traffic from a fixed IP.

Full explanation →
1534
Multi-Selecteasy

A company wants to implement a serverless data processing pipeline on AWS. The pipeline reads CSV files from Amazon S3, transforms the data, and loads it into Amazon Redshift. Which THREE AWS services should be used to build this pipeline?

Select 3 answers
A.AWS Database Migration Service (DMS)
B.Amazon EC2
C.AWS Lambda
D.AWS Glue
E.Amazon Redshift
AnswersC, D, E

Lambda can be triggered by S3 events to start the pipeline.

Why this answer

AWS Lambda is correct because it can be triggered by S3 events when a CSV file is uploaded, and it can execute lightweight data transformation logic (e.g., parsing CSV rows, filtering, or converting formats) before loading the data into Amazon Redshift. Lambda is serverless, scales automatically, and integrates natively with S3 and Redshift via the AWS SDK, making it ideal for event-driven, short-running transformations in a serverless pipeline.

Exam trap

The trap here is that candidates often confuse AWS DMS (option A) as a data loading tool for Redshift, but DMS is for database migration, not for serverless file transformation and loading from S3.

Full explanation →
1535
MCQmedium

A company is designing a new microservices application on AWS. Each microservice will be deployed as a containerized application using Amazon ECS with Fargate launch type. The company expects variable traffic patterns and needs to ensure that the application can scale automatically based on demand. Which scaling solution should be used?

A.Use Amazon EC2 Auto Scaling to add more Fargate tasks.
B.Configure Application Auto Scaling with a target tracking scaling policy based on average CPU utilization.
C.Use AWS Auto Scaling Plans with predictive scaling.
D.Manually adjust the desired count of tasks in the ECS service based on traffic analysis.
AnswerB

Application Auto Scaling with target tracking is the standard method to automatically scale ECS services based on a metric like CPU.

Why this answer

Amazon ECS with Fargate uses Application Auto Scaling to automatically adjust the desired count of tasks based on demand. A target tracking scaling policy based on average CPU utilization is the correct approach because it allows you to define a target value (e.g., 70% CPU) and Application Auto Scaling will add or remove tasks to maintain that target, matching the variable traffic patterns described.

Exam trap

The trap here is confusing EC2 Auto Scaling (which manages instances) with Application Auto Scaling (which manages ECS tasks), leading candidates to choose Option A despite Fargate being serverless and not requiring EC2 instance management.

How to eliminate wrong answers

Option A is wrong because Amazon EC2 Auto Scaling manages EC2 instances, not Fargate tasks; Fargate tasks are serverless and scaled via Application Auto Scaling, not EC2 Auto Scaling. Option C is wrong because AWS Auto Scaling Plans with predictive scaling is designed for recurring, predictable traffic patterns (e.g., based on historical data), not for variable, unpredictable traffic patterns as described in the question. Option D is wrong because manually adjusting the desired count of tasks does not meet the requirement for automatic scaling based on demand; it requires human intervention and analysis, which is not automated.

Full explanation →
1536
MCQeasy

A company has a decentralized IT structure where each business unit manages its own AWS accounts. The central IT team wants to enforce security policies across all accounts but allow business units to retain administrative control. Which solution should the central IT team implement?

A.Deploy AWS CloudFormation StackSets to each account with security templates.
B.Create a shared services account and use IAM cross-account roles for each business unit.
C.Use AWS Organizations with service control policies (SCPs) to enforce baseline permissions, and delegate administration to organizational units (OUs) for each business unit.
D.Migrate all workloads to a single AWS account and use IAM roles for each business unit.
AnswerC

SCPs enforce policies across all accounts while OUs allow delegation.

Why this answer

AWS Organizations with SCPs allows the central IT team to enforce baseline security policies across all accounts without removing administrative control from business units. By delegating administration to OUs for each business unit, the central team sets guardrails while business units retain full IAM management within their accounts, satisfying the decentralized structure requirement.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking SCPs remove all administrative control, when in fact SCPs only set upper permission boundaries and allow business units to retain full administrative autonomy within those limits.

How to eliminate wrong answers

Option A is wrong because CloudFormation StackSets deploy resources and templates but do not enforce ongoing security policies; business units could modify or delete the deployed resources, and StackSets lack the ability to set permission guardrails. Option B is wrong because a shared services account with cross-account roles centralizes access control, which contradicts the requirement for business units to retain administrative control over their own accounts. Option D is wrong because migrating all workloads to a single account violates the decentralized IT structure and removes business unit autonomy, while IAM roles alone cannot enforce baseline security policies across separate accounts.

Full explanation →
1537
MCQeasy

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. They need to offload SSL/TLS termination to reduce CPU usage on the instances. What should they do?

A.Install a self-signed certificate on each EC2 instance
B.Use a Network Load Balancer (NLB) with SSL pass-through
C.Configure the ALB with an SSL certificate
D.Use Amazon CloudFront for SSL termination
AnswerC

Configuring the ALB with an SSL certificate offloads SSL/TLS termination to the load balancer, reducing CPU usage on the instances. This is the recommended approach.

Why this answer

An Application Load Balancer (ALB) can terminate SSL/TLS by installing a certificate on it, reducing CPU load on backend EC2 instances. Option A (self-signed certificate on each instance) does not offload SSL and is less secure. Option B (NLB with SSL pass-through) does not terminate SSL; it passes encrypted traffic through.

Option D (CloudFront) can terminate SSL but is a CDN service, not primarily for SSL offload in this architecture, and adds cost and complexity.

Full explanation →
1538
MCQhard

A company is migrating a monolithic application to a microservices architecture on AWS. The application uses a relational database with complex queries. The team wants to decouple the database layer and allow each microservice to own its data. Which design pattern should the team implement?

A.Implement an event-driven architecture using Amazon SQS and AWS Lambda with CQRS.
B.Deploy a read replica of the database for each microservice to offload queries.
C.Use a single Amazon RDS instance with multiple schemas for each microservice.
D.Use a database-per-service pattern with each microservice having its own Amazon DynamoDB table or RDS instance.
AnswerD

Database-per-service ensures each microservice owns its data, enabling independent development and scaling.

Why this answer

The database-per-service pattern ensures each microservice has its own database, promoting loose coupling and independent scaling. Option A is wrong because an event-driven architecture with CQRS is a separate pattern for handling commands and queries, not for database decoupling per service. Option B is wrong because read replicas are used to offload read traffic from a single database, not to provide each microservice its own data store.

Option C is wrong because a single RDS instance with multiple schemas still results in a shared database, contradicting the goal of decoupling.

Full explanation →
1539
MCQhard

Refer to the exhibit. An IAM policy is attached to a user. The user is trying to download an object from the 'confidential' folder in 'my-bucket' using HTTP (not HTTPS). What will happen?

A.The request is denied because the second statement denies access from the IP range.
B.The request is denied because the first statement only allows from a specific IP range.
C.The request is denied because the second statement explicitly denies access when using HTTP.
D.The request is allowed because the first statement allows s3:GetObject.
AnswerC

The Deny statement denies all S3 actions on confidential/* when SecureTransport is false.

Why this answer

The Deny statement explicitly denies s3:* actions on the confidential folder when SecureTransport is false (HTTP). Since the first statement allows GetObject for the whole bucket, but the Deny overrides (explicit deny), the request will be denied. Option A (allowed) ignores the Deny.

Option B (denied due to first statement) is wrong because first statement allows. Option D (denied due to IP condition) is wrong because the IP condition is only on the Allow statement.

Full explanation →
1540
MCQeasy

A company uses AWS Organizations with a management account and several member accounts. The security team wants to ensure that all member accounts have AWS CloudTrail enabled and that logs are delivered to a centralized S3 bucket in the management account. What should they do?

A.Create a CloudTrail trail in the management account that applies to all accounts in the organization.
B.Use AWS CloudFormation StackSets to deploy a CloudTrail configuration to all accounts.
C.Enable CloudTrail in each member account and configure it to deliver logs to the management account's S3 bucket.
D.Apply an SCP to require CloudTrail to be enabled in all accounts.
AnswerA

Organization trail simplifies management.

Why this answer

AWS CloudTrail supports organization trails, which can be created in the management account and automatically apply to all member accounts within the AWS Organization. This ensures that all accounts have CloudTrail enabled and logs are delivered to a centralized S3 bucket in the management account without requiring per-account configuration.

Exam trap

The trap here is that candidates often think SCPs can enforce positive actions like enabling a service, but SCPs only deny or allow actions and cannot proactively configure resources.

How to eliminate wrong answers

Option B is wrong because AWS CloudFormation StackSets can deploy CloudTrail configurations across accounts, but this approach requires manual setup, ongoing maintenance, and does not automatically apply to new accounts added to the organization. Option C is wrong because enabling CloudTrail in each member account individually is inefficient, does not scale, and does not enforce compliance across all accounts; it also requires manual configuration for each account. Option D is wrong because Service Control Policies (SCPs) can only restrict permissions (e.g., deny disabling CloudTrail) but cannot proactively enable CloudTrail or configure it to deliver logs to a centralized bucket.

Full explanation →
1541
MCQeasy

A solutions architect is designing a new serverless application using AWS Lambda for business logic, Amazon API Gateway for RESTful APIs, and Amazon DynamoDB for data storage. The application will experience unpredictable traffic spikes. What is the MOST cost-effective way to handle concurrency and scaling?

A.Use Lambda provisioned concurrency to pre-warm instances.
B.Use Lambda reserved concurrency to set a limit on concurrent executions.
C.Configure DynamoDB auto scaling to handle traffic spikes.
D.Set a usage plan in API Gateway with a throttling limit.
AnswerB

Reserved concurrency controls the maximum number of concurrent Lambda invocations, preventing excessive scaling and cost.

Why this answer

Lambda reserved concurrency sets a hard limit on the number of concurrent executions for a function, preventing runaway scaling and controlling costs during unpredictable traffic spikes. It ensures that the function does not consume more concurrency than allocated, which avoids excessive DynamoDB read/write capacity usage and keeps costs predictable without needing to pre-warm instances.

Exam trap

The trap here is that candidates confuse provisioned concurrency (which reduces latency but adds cost) with reserved concurrency (which controls scaling and cost), or they mistakenly think DynamoDB auto scaling or API Gateway throttling directly manages Lambda concurrency.

How to eliminate wrong answers

Option A is wrong because provisioned concurrency pre-warms a fixed number of instances to reduce cold starts, but it incurs additional costs even when idle and does not control scaling or concurrency limits during spikes—it is not cost-effective for unpredictable traffic. Option C is wrong because DynamoDB auto scaling adjusts read/write capacity based on actual traffic, but it does not directly handle Lambda concurrency or scaling; it only manages the database side and can still lead to high costs if Lambda invocations spike. Option D is wrong because a usage plan in API Gateway throttles requests at the API level, but it does not control Lambda concurrency or scaling; it may reject valid requests rather than managing cost-efficient concurrency.

Full explanation →
1542
Multi-Selecteasy

A company is migrating an on-premises application to AWS and wants to implement a continuous integration/continuous delivery (CI/CD) pipeline. Which TWO AWS services should the company use to build the pipeline?

Select 2 answers
A.AWS Cloud9
B.AWS CodePipeline
C.AWS CodeCommit
D.AWS CodeArtifact
E.Amazon CodeGuru
AnswersB, C

AWS CodePipeline is a fully managed CI/CD service that automates the build, test, and deploy phases of a release process. It is the correct service for building a CI/CD pipeline.

Why this answer

AWS CodePipeline is a fully managed CI/CD service that automates the build, test, and deploy phases. AWS CodeCommit is a managed source control service that hosts Git repositories. Together, they form a robust CI/CD pipeline.

AWS Cloud9 is an IDE, not a CI/CD service. AWS CodeArtifact is for artifact management, and Amazon CodeGuru provides code reviews and performance recommendations. Therefore, the correct answers are AWS CodePipeline (B) and AWS CodeCommit (C).

Full explanation →
1543
MCQmedium

A company has multiple AWS accounts managed via AWS Organizations. The security team requires that all S3 buckets across all accounts be encrypted with AWS KMS and that bucket policies enforce HTTPS. What is the MOST efficient way to enforce these policies across all accounts?

A.Apply a service control policy (SCP) to the management account.
B.Create a custom AWS Lambda function to monitor and remediate non-compliant buckets.
C.Apply a service control policy (SCP) to the organizational unit (OU) containing all accounts.
D.Use AWS Config rules with automatic remediation in each account.
AnswerC

SCPs at the OU level enforce policies across all member accounts.

Why this answer

Applying an SCP at the OU level that denies S3 bucket creation/updates without KMS encryption and HTTPS enforcement provides centralized enforcement across all accounts in the OU. This is the most efficient method as it prevents non-compliant actions at the API level. Option A is incorrect because SCPs applied to the management account do not affect member accounts and the management account itself is not restricted by SCPs.

Option B is incorrect because while Lambda functions could remediate, they are reactive and require per-account deployment, making them less efficient than proactive SCP enforcement. Option D is incorrect because AWS Config rules can detect non-compliance but do not automatically enforce; automatic remediation may require additional setup and is also reactive.

Full explanation →
1544
MCQhard

A company is designing a real-time analytics platform that ingests data from thousands of IoT devices. Each device sends a JSON payload every second. The company needs to store the raw data for a month and then aggregate it into hourly summaries for long-term storage. The solution must be serverless and cost-effective. Which combination of AWS services should the company use?

A.Amazon Kinesis Data Streams to ingest data, AWS Lambda to transform and aggregate, Amazon S3 for storage.
B.Amazon Kinesis Data Streams to ingest data, Amazon Kinesis Data Analytics to aggregate in real-time, Amazon Kinesis Data Firehose to deliver aggregated data to S3, and an S3 Lifecycle policy to expire raw data after 30 days.
C.Amazon Kinesis Data Streams to ingest data, Amazon Kinesis Data Firehose to deliver to S3, and Amazon Athena to query raw data.
D.Amazon SQS to ingest data, AWS Lambda to process and aggregate, Amazon DynamoDB for raw data, S3 for summaries.
AnswerB

This design uses serverless services for real-time ingestion, aggregation, and cost-effective storage.

Why this answer

Kinesis Data Streams ingests real-time data, Kinesis Data Analytics performs real-time aggregation, and Kinesis Data Firehose delivers aggregated data to S3. An S3 Lifecycle policy can expire raw data after 30 days. Option A uses Lambda for aggregation, which is not ideal for streaming aggregations.

Option C misses the real-time aggregation step. Option D uses SQS, which is not designed for real-time streaming, and DynamoDB is not suitable for raw data storage at high volumes.

Full explanation →
1545
MCQhard

A company is migrating a monolithic application to microservices on Amazon ECS with Fargate. The application has variable traffic patterns, with high traffic during business hours and low traffic at night. They want to optimize costs while maintaining performance. Which scaling strategy should they implement?

A.Use target tracking scaling with a schedule to increase minimum capacity during business hours.
B.Use step scaling policies based on memory utilization.
C.Use scheduled scaling to increase capacity during business hours.
D.Use simple scaling policies based on CPU utilization.
AnswerA

This combination handles both patterns.

Why this answer

Combining target tracking scaling with a scheduled action allows the application to dynamically adjust capacity based on actual demand while ensuring a higher baseline during peak business hours. This hybrid approach optimizes costs by scaling down at night and maintains performance by preventing cold starts or lag during traffic spikes, which is ideal for variable patterns on ECS Fargate.

Exam trap

The trap here is that candidates often choose scheduled scaling alone (Option C) thinking it directly handles variable traffic, but they miss that it cannot react to unexpected spikes or lulls within the scheduled window, whereas target tracking with a schedule provides both proactive and reactive scaling.

How to eliminate wrong answers

Option B is wrong because step scaling policies based on memory utilization are less responsive to traffic-driven CPU spikes and can cause thrashing if memory is not the bottleneck; they also lack the predictive baseline needed for variable patterns. Option C is wrong because scheduled scaling alone cannot adapt to real-time fluctuations within business hours, leading to either over-provisioning or under-provisioning if traffic deviates from the schedule. Option D is wrong because simple scaling policies are deprecated in AWS and lack the cooldown and metric stabilization features of target tracking, making them prone to oscillation and inefficient for variable traffic.

Full explanation →
1546
MCQmedium

A company is running a web application on Amazon EC2 instances behind an Application Load Balancer. The application experiences high latency during peak hours. The company wants to improve performance by enabling HTTP/2. What is the simplest way to achieve this?

A.Configure the EC2 instances to support HTTP/2.
B.Place an Amazon CloudFront distribution in front of the ALB and enable HTTP/2.
C.Enable HTTP/2 on the Application Load Balancer's HTTPS listener.
D.Upgrade the load balancer to a Network Load Balancer.
AnswerC

Enabling HTTP/2 on the ALB's HTTPS listener is the simplest and most direct way to utilize HTTP/2 for the application.

Why this answer

Enabling HTTP/2 on the Application Load Balancer's HTTPS listener is the simplest way to improve performance during peak hours because ALB natively supports HTTP/2 and can be configured directly in the listener settings without additional infrastructure. Option A is incorrect because configuring EC2 instances to support HTTP/2 does not affect the load balancer's protocol handling. Option B is incorrect because adding a CloudFront distribution in front of the ALB is more complex and does not leverage the ALB's built-in HTTP/2 support.

Option D is incorrect because Network Load Balancers do not support HTTP/2; upgrading to NLB would not achieve the desired performance improvement.

Full explanation →
1547
MCQhard

A company uses AWS CodeBuild to run unit tests. The build process is taking longer than expected. The buildspec.yml file includes a pre-build phase that downloads dependencies from a public repository. What is the most effective way to reduce build time?

A.Configure the build project to use an S3 cache for dependencies.
B.Run the build in parallel across multiple build projects.
C.Increase the compute type of the build environment to use more vCPUs.
D.Reduce the build timeout setting to force faster execution.
AnswerA

Correct. Caching dependencies in S3 prevents repeated downloads, saving significant time.

Why this answer

Caching dependencies in an S3 bucket avoids re-downloading them from the public repository on every build, which is the most effective way to reduce build time as network downloads are typically the bottleneck. Increasing compute resources (Option C) may not help if the bottleneck is network bandwidth, and parallel builds (Option B) are for running multiple builds concurrently, not speeding up a single build. Reducing the build timeout (Option D) does not speed up execution; it just cancels a build that exceeds the limit.

Full explanation →
1548
MCQeasy

A company wants to ensure that no IAM user in any account can create access keys. The company uses AWS Organizations. Which approach should be used?

A.Enable AWS CloudTrail and set up a metric filter for CreateAccessKey
B.Apply an IAM policy to all users in each account that denies iam:CreateAccessKey
C.Attach an SCP to the root OU that denies iam:CreateAccessKey
D.Use AWS Config to detect access key creation and trigger a Lambda to delete the key
AnswerC

SCPs centrally deny actions across all accounts.

Why this answer

A Service Control Policy (SCP) attached to the root organizational unit denies the iam:CreateAccessKey action across all accounts in the organization, providing centralized enforcement. Option A is wrong because CloudTrail logs events but does not prevent them. Option B is wrong because applying an IAM policy in each account is not centrally managed and may be overridden by administrator permissions.

Option D is wrong because AWS Config detects but cannot prevent the action, and the remediation Lambda may have a delay.

Full explanation →
1549
MCQeasy

A company is migrating a monolithic Java application to AWS. The current architecture uses a single Oracle database. The migration plan is to refactor the application into microservices and use separate Amazon RDS for PostgreSQL databases per service. The company also wants to implement a CI/CD pipeline using AWS CodePipeline and AWS CodeBuild. Which tool should the company use to automate the database schema changes for each microservice?

A.Flyway, integrated into the CI/CD pipeline to run database migrations as part of the application deployment.
B.AWS Database Migration Service (DMS) to continuously replicate schema changes from the source Oracle database.
C.AWS CloudFormation with custom resource Lambda functions to run SQL scripts.
D.AWS CLI scripts executed in CodeBuild to run SQL commands against the target databases.
AnswerA

Flyway is a well-known database migration tool that can be integrated into CodePipeline for versioned schema changes.

Why this answer

Flyway is a database migration tool that integrates directly into CI/CD pipelines, allowing schema changes to be version-controlled and applied automatically during application deployment. For a microservices architecture with separate PostgreSQL databases, Flyway can manage each service's schema independently, ensuring consistency and rollback capability. This aligns with the requirement to automate schema changes per microservice as part of the migration and modernization effort.

Exam trap

The trap here is that candidates may confuse data migration tools (like AWS DMS) with schema migration tools, or assume that any scripting approach (like AWS CLI) is sufficient, overlooking the need for version control, repeatability, and integration with application deployment pipelines that Flyway provides.

How to eliminate wrong answers

Option B is wrong because AWS DMS is designed for continuous data replication and one-time migrations, not for managing version-controlled schema changes in a CI/CD pipeline; it does not integrate with application deployment workflows. Option C is wrong because AWS CloudFormation with custom Lambda functions is overly complex and not purpose-built for database schema migrations; it lacks built-in versioning, rollback, and migration sequencing that tools like Flyway provide. Option D is wrong because AWS CLI scripts executed in CodeBuild to run SQL commands are fragile, error-prone, and lack version control, dependency management, and repeatability; they do not handle migration history or rollbacks reliably.

Full explanation →
1550
MCQmedium

A company is designing a new microservices architecture on AWS. They need to ensure that services can communicate asynchronously without tight coupling. Which AWS service should they use to decouple the services while providing durable message storage?

A.Amazon SNS
B.Amazon EventBridge
C.Amazon Kinesis Data Streams
D.Amazon SQS
AnswerD

SQS provides a fully managed message queue that decouples microservices with durable, scalable message storage.

Why this answer

Amazon SQS (Simple Queue Service) is the correct choice because it provides a fully managed message queue that enables asynchronous communication between microservices, decoupling them so that producers and consumers operate independently. SQS offers durable message storage by persisting messages across multiple Availability Zones, ensuring messages are not lost even if a consumer fails. This aligns with the requirement for loose coupling and reliable message delivery.

Exam trap

The trap here is that candidates often confuse Amazon SNS (pub/sub) with SQS (queue), overlooking that SNS does not provide durable message storage or consumer-driven polling, which are essential for decoupled asynchronous communication.

How to eliminate wrong answers

Option A is wrong because Amazon SNS is a pub/sub messaging service that pushes messages to subscribers, but it does not provide durable message storage; messages are not persisted if a subscriber is unavailable, and it lacks the queue-based decoupling needed for asynchronous microservices. Option B is wrong because Amazon EventBridge is a serverless event bus for routing events between services, but it does not offer durable message storage; events are not retained after delivery, and it is designed for event-driven architectures rather than persistent queueing. Option C is wrong because Amazon Kinesis Data Streams is designed for real-time streaming of large data volumes with a focus on ordered processing and replay, not for simple asynchronous decoupling with durable message storage; it requires consumers to manage checkpoints and does not provide the same at-least-once delivery semantics as SQS.

Full explanation →
1551
MCQeasy

A company wants to assess its on-premises environment for migration to AWS. The assessment should include server utilization, dependencies, and recommendations. Which AWS service provides this capability?

A.AWS Application Discovery Service
B.AWS CloudFormation
C.AWS Migration Hub
D.AWS Systems Manager
AnswerA

Application Discovery Service collects data about on-premises servers, including utilization and dependencies.

Why this answer

AWS Application Discovery Service is the correct answer because it directly performs the assessment described: it collects data on on-premises server utilization, network dependencies, and provides migration recommendations. AWS Migration Hub (C) tracks migration progress but does not perform discovery. AWS CloudFormation (B) provisions resources, and AWS Systems Manager (D) manages instances, neither of which provide discovery capabilities.

Full explanation →
1552
MCQmedium

A company is designing a serverless application using AWS Lambda. The application needs to store and retrieve JSON documents. The company wants the lowest cost for infrequent access. Which data store should be used?

A.Amazon RDS for MySQL
B.Amazon S3 Standard
C.Amazon ElastiCache for Redis
D.Amazon DynamoDB (on-demand)
AnswerD

Amazon DynamoDB with on-demand capacity is serverless, scales automatically, and is cost-effective for infrequent access with no minimum charges.

Why this answer

Amazon DynamoDB with on-demand capacity is serverless and cost-effective for infrequent access. Option A is wrong because Amazon RDS for MySQL is relational and not serverless, and would require provisioning and scaling, leading to higher cost. Option B is wrong because Amazon S3 Standard is not ideal for small JSON documents and has higher cost for frequent updates or retrieval.

Option C is wrong because Amazon ElastiCache for Redis is a cache, not a durable store.

Full explanation →
1553
MCQhard

A company uses AWS CloudFormation to deploy infrastructure. The team wants to ensure that all resources are tagged with a CostCenter tag. They want to automatically remediate any stack that creates resources without the required tag. Which approach is MOST effective?

A.Create a Lambda function that tags resources after creation.
B.Use IAM policies to require tagging on all resource creation.
C.Use a CloudFormation stack policy with a deny effect for resource creation without tags.
D.Use an AWS Config rule with auto-remediation via SSM Automation.
AnswerD

Correct: An AWS Config rule can evaluate resources as they are created and trigger an SSM Automation document to automatically apply the required CostCenter tag, providing near real-time remediation.

Why this answer

Using an AWS Config rule with auto-remediation via SSM Automation can detect untagged resources in near real-time and automatically apply the required CostCenter tag, ensuring compliance without manual intervention. Option A is incorrect because tagging after creation is reactive and does not prevent untagged resources from existing temporarily. Option B is incorrect because IAM policies cannot enforce tagging across all services consistently, and many services allow resource creation without tags even with IAM restrictions.

Option C is incorrect because CloudFormation stack policies only control updates and deletions, not creation; they cannot prevent the creation of untagged resources.

Full explanation →
1554
MCQhard

A large enterprise uses AWS Organizations with 200 accounts. The central security team has implemented a service control policy (SCP) that denies all actions unless the request comes from a specific set of allowed AWS services. The SCP is attached to the root OU. Recently, the DevOps team reported that they cannot launch Amazon EC2 instances in any account, even though they have full administrator access via IAM roles. The security team verifies that the SCP is correctly configured and that allowed services include EC2. However, the error message states 'Action 'ec2:RunInstances' is not authorized.' The DevOps team is using the AWS Management Console. What is the MOST LIKELY cause?

A.The SCP does not include 'ec2:RunInstances' in the list of allowed actions.
B.The SCP is attached only to the root OU and not to the specific account OUs.
C.The IAM roles used by the DevOps team do not have a trust policy that allows the EC2 service.
D.The SCP denies all actions except those from allowed services, but the console makes calls that are not from an allowed service.
AnswerD

The console may call other services (e.g., CloudFormation) to launch instances, which could be denied if not in allowed list.

Why this answer

SCPs that deny all actions unless the request comes from allowed services would block the initial API call to EC2 because the console makes calls to multiple services. Option A is wrong because the SCP already allows EC2. Option B is wrong because the SCP is attached to the root OU, so it applies to all accounts.

Option C is wrong because the issue is not about resource-based policies.

Full explanation →
1555
MCQeasy

A company has multiple AWS accounts and wants to centralize CloudTrail logs in a single S3 bucket in the security account. Which policy should be applied to the S3 bucket to allow cross-account delivery from all member accounts?

A.Add an IAM role in the security account and allow the CloudTrail service in each member account to assume that role.
B.Configure the bucket ACL to allow write access for all member account root users.
C.Add a bucket policy that grants the service principal 'logs.amazonaws.com' s3:PutObject permissions.
D.Add a bucket policy that grants the CloudTrail service principal s3:PutObject permissions for the bucket, with a condition that the source account is in the organization.
AnswerD

This is the standard method for cross-account CloudTrail log delivery.

Why this answer

CloudTrail cross-account logging requires a bucket policy that grants the CloudTrail service principal (cloudtrail.amazonaws.com) s3:PutObject permission, with a condition (aws:SourceOrgID or aws:SourceAccount) to restrict access to only the member accounts within the AWS Organization. This ensures centralized delivery while preventing unauthorized accounts from writing to the bucket.

Exam trap

The trap here is confusing the 'logs.amazonaws.com' service principal (used for VPC Flow Logs, ELB logs, etc.) with the 'cloudtrail.amazonaws.com' service principal required for CloudTrail cross-account delivery.

How to eliminate wrong answers

Option A is wrong because CloudTrail does not use IAM role assumption for cross-account delivery; it relies on resource-based policies (bucket policies) on the S3 bucket, not on the security account assuming a role. Option B is wrong because S3 bucket ACLs are legacy and do not support cross-account CloudTrail delivery; CloudTrail requires a bucket policy, not ACLs, and root user access is not the mechanism used. Option C is wrong because the service principal 'logs.amazonaws.com' is used for AWS service logs (like ELB or CloudFront), not for CloudTrail; CloudTrail uses the 'cloudtrail.amazonaws.com' service principal.

Full explanation →
1556
MCQmedium

A company is designing a new data lake on AWS using Amazon S3. The data will be ingested from various sources, including IoT devices, application logs, and streaming data. The data must be processed in near real-time as it arrives. Which combination of services should be used for ingestion and processing?

A.Amazon S3 Transfer Acceleration and AWS Lambda
B.Amazon Kinesis Data Firehose and Amazon Kinesis Data Analytics
C.Amazon Athena and Amazon S3
D.AWS Glue and Amazon Redshift
AnswerB

Kinesis Data Firehose can ingest streaming data and deliver it to S3 for the data lake. Kinesis Data Analytics can process the data in near real-time.

Why this answer

Amazon Kinesis Data Firehose is the correct ingestion service because it can reliably capture and load streaming data into Amazon S3 in near real-time without custom code. Amazon Kinesis Data Analytics then processes the data using SQL or Apache Flink as it arrives, enabling near real-time transformations and analytics before the data lands in the data lake.

Exam trap

The trap here is that candidates often confuse Amazon S3 Transfer Acceleration (a speed optimization for large file uploads) with a streaming ingestion service, or assume that Athena can process data as it arrives, when in fact Athena only queries data at rest in S3.

How to eliminate wrong answers

Option A is wrong because Amazon S3 Transfer Acceleration is a feature that speeds up uploads over long distances using edge locations, but it does not provide streaming ingestion or near real-time processing capabilities; AWS Lambda alone cannot handle continuous high-throughput streaming ingestion without a buffer like Kinesis. Option C is wrong because Amazon Athena is an interactive query service for analyzing data already stored in S3, not a service for ingesting or processing streaming data in near real-time. Option D is wrong because AWS Glue is a serverless data integration service for batch ETL and cataloging, and Amazon Redshift is a data warehouse for analytics on structured data; neither is designed for near real-time streaming ingestion into a data lake.

Full explanation →
1557
MCQeasy

A company has a single AWS account and wants to implement a multi-account strategy for better isolation. Which AWS service is designed to help centrally manage multiple accounts?

A.AWS IAM
B.AWS Organizations
C.AWS Control Tower
D.AWS Service Catalog
AnswerB

Organizations allows you to centrally manage multiple accounts.

Why this answer

AWS Organizations is the native AWS service designed to centrally manage multiple AWS accounts. It allows you to create a hierarchy of accounts with organizational units (OUs), apply service control policies (SCPs) for governance, and consolidate billing. This directly addresses the need for a multi-account strategy with centralized management.

Exam trap

The trap here is that candidates often confuse AWS Control Tower (a managed landing zone service) with AWS Organizations (the underlying account management service), but Control Tower relies on Organizations and is not the service designed for direct central management of multiple accounts.

How to eliminate wrong answers

Option A is wrong because AWS IAM is an identity and access management service for a single account; it cannot create or manage multiple accounts. Option C is wrong because AWS Control Tower is a higher-level service that uses AWS Organizations under the hood to set up a multi-account landing zone, but it is not the core service designed for central management—it is an orchestration layer. Option D is wrong because AWS Service Catalog is used to create and manage a catalog of approved IT services (e.g., EC2, RDS) for end users; it does not manage multiple accounts or their structure.

Full explanation →
1558
MCQeasy

A company uses AWS Organizations with several OUs for different environments (dev, test, prod). They want to restrict the use of specific EC2 instance types in the prod OU only. Which approach should they use?

A.Create a separate AWS account for prod and use an IAM policy on the account.
B.Attach a service control policy (SCP) to the prod OU that denies ec2:RunInstances for non-approved instance types.
C.Attach an IAM policy to all users in the prod accounts that denies non-approved instance types.
D.Use AWS Config to detect non-approved instance types and terminate them.
AnswerB

SCPs can be applied to OUs to restrict actions in specific accounts.

Why this answer

Service control policies (SCPs) are the correct mechanism to centrally restrict permissions across all accounts within an AWS Organizations organizational unit (OU). By attaching an SCP to the prod OU that denies ec2:RunInstances for non-approved instance types, you enforce a guardrail that applies to every principal (including root users) in all accounts under that OU, regardless of IAM policies. This ensures that even if a user or role has an IAM policy allowing all EC2 instances, the SCP will block the non-approved types.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking IAM policies can centrally restrict all accounts in an OU, when in fact SCPs are the only AWS Organizations feature that applies a guardrail across all accounts without requiring per-account configuration.

How to eliminate wrong answers

Option A is wrong because creating a separate account for prod does not by itself restrict instance types; you would still need an SCP or IAM policy to enforce the restriction, and IAM policies on a single account cannot centrally manage multiple accounts. Option C is wrong because IAM policies attached to users in prod accounts can be overridden by other IAM policies or bypassed by users with administrative privileges, and they do not apply to the root user or services running without an explicit IAM role. Option D is wrong because AWS Config is a detective control that can detect non-approved instance types after they are launched, but it cannot prevent the launch; it would require a separate remediation action (e.g., Lambda) to terminate instances, which is reactive and not a preventive restriction.

Full explanation →
1559
MCQhard

A company has a multi-account AWS environment with a central logging account. They want to ensure that all VPC Flow Logs are enabled for every VPC in every account and that the logs are sent to a central S3 bucket. What combination of services should they use to automatically enforce this?

A.Use AWS Lambda to scan all VPCs daily and enable Flow Logs if missing, sending logs to the central bucket.
B.Use AWS Config rules with automatic remediation to enable VPC Flow Logs, and a CloudWatch Events rule to copy logs to the central bucket.
C.Use AWS CloudFormation StackSets to deploy a VPC with Flow Logs enabled in each account.
D.Use AWS Config rules with automatic remediation to enable VPC Flow Logs that publish to a central S3 bucket, and use an SCP to prevent disabling Flow Logs.
AnswerD

Config rules can detect VPCs without Flow Logs and remediate by enabling them; SCPs prevent tampering.

Why this answer

AWS Config rules can continuously evaluate whether VPC Flow Logs are enabled for every VPC, and automatic remediation (via an SSM automation document or Lambda) can enable them if they are missing, publishing directly to a central S3 bucket. An SCP (Service Control Policy) then prevents any IAM action that would disable or modify the Flow Log configuration, ensuring enforcement is permanent and cannot be bypassed by account administrators.

Exam trap

The SAP-C02 exam often tests the misconception that a reactive approach (like daily Lambda scans) or a deployment-only approach (like StackSets) is sufficient, when the real requirement is continuous enforcement and prevention of disabling — which demands a combination of AWS Config with remediation and an SCP.

How to eliminate wrong answers

Option A is wrong because a daily Lambda scan is reactive and not continuous; it introduces a window of non-compliance between scans, and it does not prevent disabling of Flow Logs after they are enabled. Option B is wrong because while AWS Config rules with remediation can enable Flow Logs, copying logs via CloudWatch Events to a central bucket is inefficient and adds complexity; VPC Flow Logs can be published directly to a central S3 bucket without needing a separate copy mechanism. Option C is wrong because CloudFormation StackSets can only deploy resources where they are explicitly defined; they cannot enforce Flow Logs on existing VPCs or prevent future VPCs from being created without Flow Logs, nor can they prevent disabling of Flow Logs.

Full explanation →
1560
MCQeasy

A company uses AWS Organizations and has a requirement that all root user activities in member accounts must be immediately reported to the security team. Which combination of actions should be taken to meet this requirement? (Choose the best answer.)

A.Enable AWS CloudTrail and use Amazon Athena to query logs periodically and send a report.
B.Enable AWS CloudTrail in all accounts with a trail that logs management events and delivers to a centralized S3 bucket. Use Amazon CloudWatch Events to create a rule that matches root user API calls and sends notifications via Amazon SNS.
C.Use AWS Config rules to detect root user activities and trigger an AWS Lambda function to send an email.
D.Use AWS Trusted Advisor to check for root user usage and generate a weekly report.
AnswerB

This provides real-time alerting on root activities.

Why this answer

It combines AWS CloudTrail logging of management events across all accounts into a centralized S3 bucket with Amazon CloudWatch Events (now Amazon EventBridge) to detect root user API calls in real time. This setup ensures immediate notification via Amazon SNS, meeting the requirement for instant reporting without manual polling or batch processing.

Exam trap

The trap here is that candidates may confuse AWS Config rules (which monitor resource configurations) with CloudTrail event monitoring, or assume periodic tools like Athena or Trusted Advisor can satisfy an immediate reporting requirement.

How to eliminate wrong answers

Option A is wrong because using Amazon Athena to query logs periodically introduces a delay (not immediate reporting) and requires manual or scheduled queries, which does not meet the real-time requirement. Option C is wrong because AWS Config rules are designed for resource configuration compliance and change detection, not for monitoring API calls like root user activities; they cannot directly capture CloudTrail events or root user login actions. Option D is wrong because AWS Trusted Advisor provides a weekly report on root user usage, which is not immediate and fails the requirement for real-time notification.

Full explanation →
1561
MCQeasy

A company wants to deploy a containerized web application on AWS. They need to manage container orchestration, automatic scaling, and service discovery. Which AWS services should they use? (Select TWO.)

A.Amazon Lightsail
B.Amazon Elastic Container Service (ECS)
C.Amazon Elastic Kubernetes Service (EKS)
D.AWS Elastic Beanstalk
AnswerB, C

Amazon ECS is a fully managed container orchestration service that supports automatic scaling and service discovery, making it a valid option.

Why this answer

Amazon ECS and Amazon EKS both provide container orchestration, automatic scaling, and service discovery. ECS is a fully managed container orchestration service tightly integrated with AWS, while EKS offers Kubernetes-based orchestration. Both meet the requirements, so options B and C are correct.

Lightsail is for simple VMs or containers, not full orchestration. Elastic Beanstalk is a PaaS service that can deploy containers but lacks native container orchestration features.

Full explanation →
1562
MCQhard

A CloudFormation stack creation failed with the status shown in the exhibit. The stack was created using a template that defines an EC2 instance, a security group, and an Elastic IP address. What is the MOST likely cause of the failure?

A.The AWS account has reached the Elastic IP address limit.
B.The security group rule is invalid.
C.The EC2 instance failed to associate with the Elastic IP.
D.The EC2 instance type is not supported in the region.
AnswerA

The error message explicitly states the maximum number of addresses has been reached.

Why this answer

The stack creation failed with a status that indicates a resource creation failure, and the most likely cause is that the AWS account has reached its Elastic IP address limit. Each AWS account has a default limit of 5 Elastic IP addresses per region, and attempting to create a new Elastic IP beyond this quota causes the CloudFormation stack to roll back. The error message in the exhibit (not shown here but implied) typically states 'The maximum number of addresses has been reached' or similar, confirming this as the root cause.

Exam trap

The trap here is that candidates often assume the failure is due to an invalid security group rule or instance type, but the exhibit's error message (e.g., 'Resource creation cancelled' or 'API: ec2:AllocateAddress') specifically points to a quota limit on Elastic IPs, not a configuration or association issue.

How to eliminate wrong answers

Option B is wrong because an invalid security group rule would cause a validation error during stack creation, but the stack would fail with a specific error about the rule, not a generic resource creation failure. Option C is wrong because the EC2 instance failing to associate with the Elastic IP would occur after both resources are created, and CloudFormation would show a different error related to the association resource, not a failure to create the Elastic IP itself. Option D is wrong because an unsupported EC2 instance type would cause an immediate creation failure for the EC2 instance, but the error would reference the instance type, not the Elastic IP, and the stack would fail at the instance creation step, not at the Elastic IP step.

Full explanation →
1563
MCQeasy

A company is migrating an on-premises Oracle database to AWS. The database is 2 TB in size and has a low-latency connection to AWS via AWS Direct Connect. The company wants to minimize downtime during the migration. Which AWS service should the architect use for the initial data load?

A.AWS DataSync
B.AWS Snowball Edge
C.AWS Server Migration Service (AWS SMS)
D.AWS Database Migration Service (AWS DMS)
AnswerD

AWS DMS supports continuous replication, minimizing downtime.

Why this answer

AWS Database Migration Service (AWS DMS) with Oracle as source and target (e.g., RDS for Oracle) supports ongoing replication to minimize downtime. AWS Snowball is for offline data transfer and would involve longer downtime. S3 Transfer Acceleration is for S3 uploads, not database migration.

Server Migration Service is for server migration, not databases.

Full explanation →
1564
MCQmedium

A company is migrating a web application to AWS and wants to automatically scale the application based on CPU utilization. The application runs on a set of EC2 instances behind an Application Load Balancer. Which combination of AWS services should they use?

A.AWS Lambda with scheduled scaling
B.Amazon CloudFront with origin scaling
C.AWS Elastic Beanstalk with environment scaling
D.Auto Scaling group with a simple scaling policy based on CloudWatch CPU alarm
AnswerD

Auto Scaling group can scale based on CPU utilization.

Why this answer

Auto Scaling group with a simple scaling policy based on a CloudWatch CPU alarm. This directly scales EC2 instances in response to CPU utilization, providing automatic scaling. Option A is incorrect because AWS Lambda with scheduled scaling does not dynamically respond to CPU utilization; it's time-based.

Option B (Amazon CloudFront) is a content delivery network, not a scaling mechanism. Option C (Elastic Beanstalk) manages environments but the underlying scaling relies on Auto Scaling groups; the question asks for the combination of services, and the core scaling service is the Auto Scaling group. Therefore, D is the correct choice.

Full explanation →
1565
MCQeasy

A company has a multi-account AWS environment. They want to use AWS CloudTrail to log all API calls across all accounts and deliver the logs to a central S3 bucket in the logging account. They have configured a trail in the management account that logs management events for all accounts. However, they notice that the logs from member accounts are not being delivered to the central S3 bucket. What is the most likely cause?

A.CloudTrail cannot log management events for member accounts from the management account.
B.The S3 bucket policy does not grant the CloudTrail service principal from member accounts write access.
C.The trail is configured to log only read events.
D.The member accounts have disabled CloudTrail.
AnswerB

Cross-account log delivery requires proper bucket policy.

Why this answer

A trail in the management account can log management events for all accounts, but it requires that the trail be created with the option 'Apply trail to all accounts in the organization' and the S3 bucket policy must allow CloudTrail to write from member accounts. Option A is wrong because there is no such limitation. Option C is wrong because CloudTrail supports cross-account delivery.

Option D is wrong because the bucket policy is likely the issue.

Full explanation →
1566
MCQhard

A company has a central logging account that receives VPC Flow Logs, CloudTrail logs, and AWS Config logs from all accounts in the organization. The logs are stored in S3 buckets. The security team wants to analyze these logs using Amazon Athena. What is the MOST cost-effective way to ensure that the Athena queries only scan the necessary data?

A.Partition the data by account ID, region, and date in the S3 bucket, and use partitions in Athena.
B.Use S3 object-level compression (e.g., gzip) to reduce data volume.
C.Create AWS Glue partition indexes on the table.
D.Create separate Athena tables for each account and region.
AnswerA

Partition pruning ensures Athena scans only relevant partitions.

Why this answer

Partitioning the S3 data by account ID, region, and date allows Athena to use partition pruning, which limits the amount of data scanned to only the relevant partitions based on query filters. This directly reduces query cost because Athena charges per amount of data scanned, and partitioning is the most effective way to minimize scanned data without additional compression or indexing overhead.

Exam trap

The trap here is that candidates often confuse performance optimization (e.g., compression, indexes) with cost optimization (reducing data scanned), and they may overlook that partition pruning is the primary mechanism to minimize Athena query costs, not just speed up queries.

How to eliminate wrong answers

Option B is wrong because S3 object-level compression (e.g., gzip) reduces storage size and can reduce data scanned if Athena supports reading compressed files, but it does not limit which files are scanned; Athena still must read all compressed objects unless partitions are used. Option C is wrong because AWS Glue partition indexes improve query performance by reducing metadata lookup time, but they do not reduce the amount of data scanned; they only speed up partition discovery, not cost. Option D is wrong because creating separate Athena tables for each account and region increases management overhead and does not inherently reduce data scanned; queries would still scan entire tables unless partitions are used within each table, and this approach duplicates schema management without cost benefit.

Full explanation →
1567
MCQeasy

A company wants to deploy a containerized application on AWS. The application requires persistent storage that can be shared across multiple containers running on different EC2 instances. Which AWS service should be used?

A.EC2 Instance Store
B.Amazon EFS
C.Amazon S3
D.Amazon EBS
AnswerB

EFS provides a shared file system for multiple instances.

Why this answer

Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently on multiple EC2 instances. This makes it the ideal choice for persistent storage that must be shared across containers running on different EC2 instances, as it supports the NFSv4.1 and NFSv4.0 protocols and automatically scales storage capacity as files are added or removed.

Exam trap

The trap here is that candidates often confuse Amazon EBS with a shared storage solution, but EBS volumes (except for the limited multi-attach feature) can only be attached to a single EC2 instance at a time, making it unsuitable for multi-instance shared access.

How to eliminate wrong answers

Option A is wrong because EC2 Instance Store provides ephemeral block-level storage that is physically attached to the host computer, and data is lost when the instance is stopped or terminated; it cannot be shared across multiple EC2 instances. Option C is wrong because Amazon S3 is an object storage service accessed via HTTP/HTTPS APIs, not a file system that can be mounted directly by multiple EC2 instances for concurrent read/write access with standard file system semantics. Option D is wrong because Amazon EBS provides block-level storage volumes that can be attached to only one EC2 instance at a time (except for multi-attach EBS io1/io2 volumes, which are limited to a small number of Nitro-based instances and are not designed for general-purpose shared file storage across many containers).

Full explanation →
1568
Multi-Selectmedium

A company uses an Amazon RDS for MySQL DB instance. The database is experiencing high read latency. The team wants to improve read performance with minimal application changes. Which TWO actions should the team take? (Choose two.)

Select 2 answers
A.Create one or more read replicas and direct read queries to them.
B.Enable Multi-AZ deployment for failover support.
C.Migrate the database to Amazon Aurora.
D.Increase the max_connections parameter.
E.Increase the DB instance size (e.g., from db.r5.large to db.r5.xlarge).
AnswersA, E

Read replicas offload read traffic, reducing latency.

Why this answer

A: Read replicas offload read queries from the primary instance, reducing read latency with minimal application changes (only need to modify connection strings for read queries). E: Increasing the DB instance size provides more CPU and memory, which can improve query processing and reduce read latency, and does not require application changes beyond a potential brief downtime. C is incorrect because migrating to Aurora is a significant change that requires database migration and possible application modifications, not a minimal change.

B is incorrect because Multi-AZ only provides failover, not read performance improvement. D is incorrect because max_connections does not directly affect read latency.

Full explanation →
1569
Drag & Dropmedium

Drag and drop the steps to set up a cross-region VPC peering connection in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First initiate, then accept, then add routes, then update security groups, and finally network ACLs.

Full explanation →
1570
MCQmedium

A company has multiple AWS accounts managed through AWS Organizations. The security team wants to enforce that all new member accounts automatically have AWS Config enabled with a specific set of rules. Which solution is the MOST efficient?

A.Create an AWS Config aggregator in the management account and enable Config for each account manually.
B.Use AWS CloudFormation StackSets to deploy a Config template to each account, and manually add new accounts to the StackSet.
C.Use AWS Lambda functions triggered by AWS CloudTrail to enable Config and deploy rules whenever a new account is created.
D.Create an SCP to deny disabling AWS Config, and use an AWS Config conformance pack in a delegated admin account to enforce rules across the organization.
AnswerD

SCP enforces Config enablement; conformance pack enforces rules automatically on new accounts.

Why this answer

It combines an SCP to prevent disabling AWS Config with an AWS Config conformance pack deployed from a delegated admin account, which automatically applies to all existing and new member accounts in the organization. This approach is fully automated, requires no manual intervention for new accounts, and enforces both the enablement of Config and the required rules across the entire organization.

Exam trap

The trap here is that candidates often overcomplicate the solution by choosing event-driven or manual approaches (like Lambda or StackSets) instead of recognizing that native AWS Organizations and Config conformance packs provide a fully automated, policy-based enforcement mechanism that requires no per-account management.

How to eliminate wrong answers

Option A is wrong because manually enabling Config for each account is not efficient and does not scale, especially as new accounts are added. Option B is wrong because manually adding new accounts to a CloudFormation StackSet is not automated and requires ongoing administrative overhead, failing the 'most efficient' requirement. Option C is wrong because using a Lambda function triggered by CloudTrail to enable Config and deploy rules is an event-driven workaround that is less reliable and more complex than using native AWS Organizations and Config features; it also does not prevent disabling of Config after initial setup.

Full explanation →
1571
MCQeasy

A company is migrating its on-premises file server to AWS. The file server contains 50 TB of data stored on a Windows Server with NTFS permissions. The company needs to maintain the folder structure and permissions after migration. The migration must be completed within one week. The company has a 100 Mbps internet connection. Which approach should the solutions architect recommend?

A.Use AWS Storage Gateway File Gateway to cache data on-premises and sync to S3.
B.Use AWS Snowball Edge to transfer data to an S3 bucket, then use AWS DataSync to copy to Amazon FSx for Windows File Server.
C.Use AWS DataSync to transfer data directly to Amazon EFS over the internet.
D.Use AWS CLI to copy data directly to an S3 bucket, then mount S3 as a file system.
AnswerB

Offline transfer bypasses bandwidth; FSx preserves Windows permissions.

Why this answer

Given the large data size (50 TB) and limited bandwidth (100 Mbps), transferring over the internet would take approximately 46 days, exceeding the one-week window. AWS Snowball Edge provides a physical data transport solution that bypasses bandwidth constraints. After transferring data to an S3 bucket via Snowball Edge, AWS DataSync can be used to copy the data to Amazon FSx for Windows File Server, preserving folder structure and NTFS permissions.

Option A (Storage Gateway File Gateway) still requires initial network transfer, which is too slow. Option C (DataSync directly to EFS) would also be too slow over the internet and EFS does not support NTFS ACLs. Option D (CLI to S3 and mount) loses permissions and is also bandwidth-limited.

Full explanation →
1572
MCQeasy

A company is using Amazon S3 to store critical data. The security team requires that all data at rest be encrypted using AWS KMS with automatic rotation of the customer master key (CMK) every year. What should a solutions architect do to meet this requirement?

A.Use SSE-S3 (Amazon S3-managed keys) and rely on S3's automatic key rotation.
B.Enable S3 default encryption with AWS KMS and enable automatic rotation of the KMS key.
C.Use SSE-C (customer-provided keys) and manage key rotation manually.
D.Use client-side encryption with a KMS CMK and upload the encrypted data.
AnswerB

This ensures all objects are encrypted at rest with a rotating KMS key.

Why this answer

It enables S3 default encryption with AWS KMS and enables automatic rotation of the KMS key, meeting the requirement for encryption at rest with automatic key rotation. Option A is wrong because SSE-S3 uses Amazon S3-managed keys, not KMS, and does not allow automatic rotation of a customer-managed key. Option C is wrong because SSE-C uses customer-provided keys, not KMS, and requires manual key rotation.

Option D is wrong because client-side encryption does not use S3 server-side encryption and does not leverage S3's default encryption settings.

Full explanation →
1573
MCQhard

A company uses an AWS CodePipeline to deploy a serverless application. The pipeline includes a build stage that runs on AWS CodeBuild and a deploy stage that updates an AWS Lambda function. The company wants to add a manual approval step before the deploy stage. What is the most efficient way to implement this?

A.Add an AWS Lambda function that sends an email for approval.
B.Use an AWS CloudFormation stack with a wait condition.
C.Configure an Amazon SNS topic to notify approvers.
D.Add a manual approval action in the CodePipeline stage before deploy.
AnswerD

CodePipeline supports manual approval actions.

Why this answer

AWS CodePipeline has a built-in manual approval action that can be added as a stage before the deploy stage, providing the most efficient way to add manual approval. Option A is incorrect because using a Lambda function for approval is unnecessarily complex compared to the built-in action. Option B is incorrect because a CloudFormation wait condition is not designed for approval workflows in CodePipeline.

Option C is incorrect because an SNS topic can notify approvers but does not integrate directly as an approval action in CodePipeline; the manual approval action is the native solution.

Full explanation →
1574
MCQmedium

A company is planning to migrate a large-scale Hadoop cluster to Amazon EMR. The cluster currently processes batch jobs using a mix of MapReduce and Spark. The company wants to minimize changes to the existing code and operational processes. Which migration approach should the architect recommend?

A.Refactor all jobs to use only Apache Spark on Amazon EMR
B.Retire the cluster and use Amazon Athena for ad-hoc queries
C.Replatform the data processing to use Amazon Redshift Spectrum
D.Rehost the cluster on Amazon EMR using the same MapReduce and Spark configurations
AnswerD

This preserves existing code and processes, minimizing changes.

Why this answer

Rehosting the Hadoop cluster on Amazon EMR with the same configuration allows the existing MapReduce and Spark code to run with minimal changes. Refactoring to use only Spark would require code changes. Replatforming to Amazon Redshift would change the architecture.

Retiring and using Athena would require significant changes to data storage and queries.

Full explanation →
1575
MCQmedium

A company is implementing a data lake on Amazon S3. The security policy requires that all data be encrypted at rest using AWS KMS and that access must be logged. The data lake has millions of objects, and the security team wants to detect any changes to bucket policies or encryption settings. Which combination of services should be used?

A.Amazon CloudWatch Events and Amazon S3 event notifications
B.Amazon CloudWatch Logs and VPC Flow Logs
C.AWS Config and AWS CloudTrail
D.AWS CloudTrail for management events and Amazon S3 server access logs
AnswerD

CloudTrail records S3 API calls for bucket-level actions; S3 server access logs provide object-level access details.

Why this answer

AWS CloudTrail management events log changes to S3 bucket policies and encryption settings (e.g., PutBucketPolicy, PutBucketEncryption), while S3 server access logs provide detailed object-level access records. Together, they satisfy the security policy's requirements for detecting configuration changes and logging access, without needing additional services.

Exam trap

The trap here is that candidates often confuse AWS Config (which tracks configuration compliance) with CloudTrail (which logs API calls), failing to realize that Config does not log access events, so it cannot satisfy the 'access must be logged' requirement alone.

How to eliminate wrong answers

Option A is wrong because Amazon CloudWatch Events and S3 event notifications are designed for real-time event-driven workflows (e.g., triggering Lambda on object creation), not for auditing historical changes to bucket policies or encryption settings. Option B is wrong because CloudWatch Logs is a log storage/analysis service, not a source of audit logs, and VPC Flow Logs capture network traffic metadata (IP addresses, ports) but not S3 configuration changes or data access. Option C is wrong because AWS Config tracks resource configuration changes and can evaluate compliance rules, but it does not log access events; CloudTrail is needed for access logging, making this combination incomplete for the 'access must be logged' requirement.

Full explanation →
Page 20

Page 21 of 23

Page 22

All pages

1234567891011121314151617181920212223

Practice SAP-C02 by domain

Target a specific domain to shore up weak areas.

Design Solutions for Organizational ComplexityDesign for New SolutionsContinuous Improvement for Existing SolutionsAccelerate Workload Migration and Modernization
See all domains with question counts →